Such issues can appear everywhere. But if such bug will be found in widespread framework or CMS, zero-days will be exploited immediately by automated scanners (Drupal, Joomla and Wordpress had some in the history). So, protection through obscurity is some kind of protection too.